In IP networks, attacks represented by a distributed denial of service (DDoS) attack to networks are increasing, and the importance of monitoring and analyzing traffic is increasing. As a traffic analysis technology, a method using flow information that is output by a networking equipment, such as NetFlow, sFlow, or Internet protocol flow information export (IPFIX), is known (for example, see Non Patent Literature 1). With the traffic analysis technology using flow information as described above, it is possible to analyze a traffic amount for each piece of information, such as a transmission/reception IP address, a protocol, or a port number.